# Reverse Engineering Reading List

> A short reading list, compiled by One Thawt mostly in 2015–2016, of about 58 links to reverse-engineering tools, books, papers, talks and blog posts, kept in a README and a separate malware-analysis page. Sections run from disassemblers and debuggers, beginner talks and classic books through data-structure recovery papers, instruction-set references, iOS, Android and Windows material, unpacking, deobfuscation and protocol inference from network traces.

- Type: Learning resource
- Targets: Binary
- Category: Learning resources
- Relationship: Learning resource
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-27
- Original resource: <https://github.com/onethawt/reverseengineering-reading-list>
- Primary source: <https://github.com/onethawt/reverseengineering-reading-list/blob/a1ee767b5cf8504c398763b2b6304c20507ef1e3/README.md>
- Catalog page: <https://awesomerea.org/resources/onethawt-re-reading-list/>
- Record JSON: <https://awesomerea.org/resources/onethawt-re-reading-list/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/onethawt-re-reading-list/index.md)

## Requirements & limits

- Reviewed at commit a1ee767 (2023-05-02). 46 of 53 commits date from 2015–2016; the last added entries are x64dbg (2017), Binary Ninja (2018) and Ghidra (2019), and the 2023 commit merged a 2018 pull request that removed a dead link. The list therefore predates most current tools and research.
- Most entries are a bare link, some followed by a quoted publisher or project description, and there are no notes on difficulty, platform or currency. Many point to 2010–2016 posts and PDFs on personal or project sites, and the README suggests archive.org for links that are down. Six of the 59 unique URLs in the two files gave no response, a 404 or a sign-in page, and the TIE and HyperV entries link to unrelated documents (an iOS 6 security talk and an IR-synthesis slide deck).
- Books link to Amazon store pages, and IDA Pro, Binary Ninja and Hopper are commercial products. The Windows section also links older write-ups on kernel-protection bypasses.
- GitHub detects no license and the repository has no license file, so the list states no reuse terms; linked works keep their own rights. The author offers copies of unavailable documents on request through a personal contact page.

## Primary sources

1. <https://github.com/onethawt/reverseengineering-reading-list/blob/a1ee767b5cf8504c398763b2b6304c20507ef1e3/README.md>
2. <https://github.com/onethawt/reverseengineering-reading-list/blob/a1ee767b5cf8504c398763b2b6304c20507ef1e3/malwareanalysis.md>

## More in References and learning

- [Decomp Academy](https://awesomerea.org/resources/decomp-academy/index.md) · Learning resource
- [OWASP Firmware Security Testing Methodology (FSTM)](https://awesomerea.org/resources/owasp-fstm/index.md) · Learning resource
- [Emproof workshop: Firmware Reverse Engineering](https://awesomerea.org/resources/emproof-firmware-re-workshop/index.md) · Learning resource
- [iOS App Reverse Engineering](https://awesomerea.org/resources/ios-app-reverse-engineering-book/index.md) · Learning resource
- [Frida Snippets](https://awesomerea.org/resources/frida-snippets/index.md) · Learning resource
- [iOSRE: iOS Reverse Engineering reference](https://awesomerea.org/resources/kpwn-iosre/index.md) · Learning resource

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.